Version 1.0 · in force since 23.08.2026
This policy explains what personal data we process in connection with the presentation website fiscalcloud.md and with the FiscalCloud application (cloud.fiscalcloud.md) — the virtual cash register through which merchants issue receipts and keep records of sales —, for what purpose and on what legal basis, to whom we disclose it, how long we keep it, whether we transfer it outside the Republic of Moldova and what rights you have.
For some data we are a controller (the website data, the account data and the data of the commercial relationship with the client); for the fiscal data that the merchant enters in the application we are a processor, processing it on behalf of the merchant-controller.
The controller
The controller is LICENSE SOFT SRL (trade name “Soft Lider”), IDNO 1016600013480, with its registered office in Chișinău municipality, bd. Moscova 26, of. 56, MD-2045, Republic of Moldova.
For any question regarding your data or to exercise your rights, you can write to us at confidentialitate@softlider.md, by phone at +373 22 442 318 or at the postal address above, marked “data protection”.
A. The fiscalcloud.md website
For the data below, Soft Lider is a controller.
Website visitors
When you access the website, the server automatically processes technical connection data (IP address, browser and device type, date and time of access, pages visited, security logs).
- Purpose: delivery and correct functioning of the website, prevention and investigation of abuse and security incidents.
- Legal basis: our legitimate interest in maintaining a functional and secure website (art. 6(1)(f)).
- Recipients: the hosting provider (Republic of Moldova), as a processor working on our instructions.
- Retention: the logs are kept for the limited period necessary to investigate abuse, then deleted.
The “Request a Call” / contact form
We process the data you enter — your name, phone number and, if you provide it, email address — together with the message, plus related technical data (IP address, date and time) for security.
- Purpose: to contact you and respond to your request.
- Legal basis: art. 6(1)(b) for pre-contractual measures at your request; art. 6(1)(f), our legitimate interest, for managing general commercial requests.
- Provision of data: provision is voluntary — you have no legal or contractual obligation to communicate this data; name and phone number are, however, necessary so that we can contact you, and without them we cannot act on the request.
- Recipients: the website’s hosting provider (Republic of Moldova) and the corporate email provider (EEA), as processors.
- Retention: for requesters who do not become clients, as long as necessary to respond, then deletion or anonymization after a period of inactivity; for those who become clients, for the duration of the contractual relationship.
If the request concerns the combined FiscalCloud + bank terminal device, we transmit the contact data and the request to the chosen partner bank, which processes your data as an independent controller, for the purpose of its own offer. The disclosure is made at your request to receive the combined offer (a measure at the request of the data subject), respectively on our legitimate interest in acting on the request; any contract is concluded between you and the bank, not with us.
You can object at any time to the processing based on our legitimate interest — see the box “Your right to object”.
Website cookies
The website uses only strictly necessary cookies (the operation and security of the website, the language preference, the functioning of the form). They are active automatically, because without them the website does not function properly, and they have a session duration. Cookie preferences can be managed from your browser settings.
B. The FiscalCloud application (cloud.fiscalcloud.md)
In the application we process two types of data, with different roles.
Fiscal data, on behalf of the merchant (processor)
We are the processor
For the fiscal data that the merchant enters or generates in the application — the content of receipts and vouchers, sales records, individual (natural-person) customers and, where applicable, loyalty data — the controller is the merchant-client, not Soft Lider. This data may include the IDNP of individual customers, processed on behalf of the merchant.
We process it exclusively on the basis of the merchant’s documented instructions; the merchant establishes the purpose and legal basis — usually the legal obligation of fiscal record-keeping (art. 6(1)(c)) for the content of receipts and sales records, and for loyalty data a different basis, distinct from fiscal record-keeping — and it is the merchant’s responsibility to inform the data subjects.
If you are a customer, employee or counterparty of a merchant who uses FiscalCloud and you wish to exercise your rights concerning this data, you address the merchant, who is the controller. If you address the request to us, we forward it to the merchant-controller without undue delay and inform you. The conditions of the processing are established in the Data Processing Agreement (DPA) in the service contract.
Account and application usage data (controller)
For the data related to your account and to the direct relationship with us, Soft Lider is a controller:
| Data category | Purpose | Legal basis |
|---|---|---|
| Identification and account data | creating and administering the account, authentication, service communications | performance of the service contract (art. 6(1)(b)) or, for users who are not party to the contract, our legitimate interest in operating the service (art. 6(1)(f)) |
| Data about your company/organization | providing the service according to the subscription and managing the organization in the application | idem (art. 6(1)(b), respectively (f) for those who are not party to the contract) |
| Billing and payment data | invoicing the service and keeping records of payments | idem, plus legal obligation of accounting and tax record-keeping (art. 6(1)(c)) |
| Technical and usage data | security of the application, prevention of abuse, troubleshooting, integrity of the fiscal data | our legitimate interest in maintaining a secure and functional service (art. 6(1)(f)) |
| Configuration and administration data of the fiscal module | configuring and administering the fiscal module through which the merchant fulfills its fiscalization and reporting obligations; the fiscal content transmitted to the State Tax Service is processed on behalf of the merchant-controller, not on ours | performance of the service contract (art. 6(1)(b)) for the configuration and administration data; for the fiscal content, the fiscalization and reporting obligation lies with the merchant-controller |
| Commercial management (CRM) and our own marketing | administering the commercial relationship and, where appropriate, our own communications | our legitimate interest for direct marketing to existing clients (art. 6(1)(f)); consent for prospecting persons who are not clients (art. 6(1)(a)) |
Providing the account and organization data is necessary for concluding and performing the contract; without it we cannot create your account and provide the service. The data necessary for fiscalization and reporting to the tax authority is required by law. Failure to provide this data makes it impossible to use the service.
You can object to the processing based on our legitimate interest — see the box “Your right to object”.
Application cookies
The application uses only strictly necessary first-party cookies — authentication and session maintenance, form protection and the language preference —, active automatically because without them the application does not function.
Common sections (website and application)
Who else sees the data
We disclose data to:
- the application’s hosting provider (EEA) and the website’s hosting provider (Republic of Moldova), as processors working on our instructions;
- the corporate email provider (EEA), as a processor;
- the State Tax Service, a public authority acting as a separate controller; the fiscal content is transmitted to it through the fiscal module on behalf of the merchant-controller, not on ours;
- the partner banks for the payment terminals and for the combined device, as independent controllers, which process on their own basis and for their own purpose, according to their own privacy policies;
- public authorities and legal advisers, upon lawful request or in the event of a dispute, to the strictly necessary extent.
The transmission of data to the chosen bank when you request the combined device (FiscalCloud + bank terminal) is described in the section “The «Request a Call» / contact form”. Reciprocally, we receive similar leads from banks; in this case we inform you at first contact, indicating the source, and the processing is based on our legitimate interest in managing the recommendation and contacting the person who requested the combined offer (art. 6(1)(f)), with a right to object.
International transfers
The application’s hosting is located in the EEA, and the website’s hosting in the Republic of Moldova. For corporate email: the provider operates in the EEA region (Ireland), but, being part of a group with its registered office in the United States of America, the transfer is based on standard contractual clauses, as an adequate safeguard within the meaning of Chapter V of the law (art. 46). A copy of these safeguards can be obtained by writing to us at the contact address.
Your rights
In relation to the data we process as a controller, you have the right:
- of access to the data concerning you and to obtain a copy of it;
- of rectification of inaccurate or incomplete data;
- of erasure, in the cases provided for by law;
- of restriction of processing;
- to object to processing based on our legitimate interest and, at any time and unconditionally, to processing for direct marketing purposes;
- of data portability, to the extent that this right applies;
- to withdraw your consent at any time, where the processing is based on consent, without affecting the lawfulness of the processing prior to withdrawal.
You can exercise your rights by writing to us at the contact address above. If the request concerns the fiscal data we process on behalf of a merchant-client, we forward it to the merchant-controller, in accordance with the box in section B.
Your right to object
You can object at any time, on grounds relating to your particular situation, to the processing we base on our legitimate interest (including technical visit data, management of the request from the form, security and commercial management); in this case we cease the processing, unless we demonstrate compelling legitimate grounds that override yours, or the necessity for the establishment, exercise or defense of a legal right. You can object at any time and unconditionally to the processing of data for direct marketing purposes (including related profiling); in this case we immediately cease this processing, without any balancing of interests. It is enough to write to us at the contact address.
How long we keep the data
We keep the data only for as long as is necessary for the purposes for which we collected it or as long as the law requires (for example, tax and accounting legislation). Upon expiry of the period, the data is deleted or anonymized.
| Data category | Retention criterion |
|---|---|
| Technical data and logs (website and application) | the limited period necessary for security and investigation of abuse, then deletion |
| Requests from the website form | as long as necessary to respond; those who do not become clients — deletion/anonymization after inactivity; those who become clients — for the duration of the contractual relationship |
| Account and usage data | for the duration of the account, then deletion |
| Billing data and accounting documents of the service | for the duration required by tax and accounting legislation (art. 6(1)(c)) |
| Leads received from banks | until the combined-offer request is resolved, then deletion or anonymization after a period of inactivity, or earlier in case of objection |
| Prospecting and marketing based on consent | until withdrawal of consent or objection, or after a period of inactivity |
| Fiscal data processed on behalf of the merchant | for the duration required of the merchant-controller by tax legislation; upon termination of the contract, the data is deleted or returned, according to the choice of the merchant-controller and subject to the retention required by law |
The right to lodge a complaint
If you consider that we have infringed your rights, you can lodge a complaint with the National Center for Personal Data Protection (MD-2004, Chișinău municipality, str. Serghei Lazo no. 48; phone: (022) 820 801; email: centru@datepersonale.md). You can also address the court directly.
Changes to this policy
The version in force and its date are those indicated in the header of this document.